Chapter 8 Vocabulary - Controlling Information Systems: Introduction to Pervasive Controls

Segregation of Duties

Consists of separating the four basic functions of event processing: authorizing events, executing events, recording events, and safeguarding resources resulting from consummating events

Compensatory Controls

An alternative control plan put in place when segregation of duties is impossible; this is done by assigning more than one person to a single function

Policy

A plan or process put in place to guide actions and thus achieve goals

Rotation of Duties

A policy that requires an employee to alternate jobs periodically

Forced Vacations

A policy that requires an employee to take leave from the job and substitutes another employee in their place

Fidelity Bond

Indemnifies a company in case it suffers losses from defalcations committed by its employees

Monitoring

In an internal control system, means assessment by management to determine whether the control plans in place are continuing to function appropriately over time

IT Governance

A process that ensures that the enterprise’s IT sustains and extends the organization’s strategies and objectives

Firewalls

A technique to protect one network from another “untrusted” network. May be used to protect a system from intrusions from the Internet by blocking certain kinds of traffic from flowing into or out of the organization

IT Steering Committee

Coordinates the organizational and IT strategic planning processes and reviews and approves the strategic IT plan

Systems Development Life Cycle (SDLC)

The progression through the phases of the systems development process, from birth through implementation to ongoing use

Project-Management Framework

Consists of three parts: a project life cycle, a project control cycle, and tools and templates to facilitate the execution of the project

Program Change Controls

Provide assurance that all modifications to programs are authorized and that the changes are completed, tested, and properly implemented

Requirements Walkthrough

A meeting of the key stakeholders for a new system (e.g., business stakeholders, project team members). These stakeholders discuss a requirements document step by step in order to finalize the requirement before development begins. Discussing the requirements helps stakeholders arrive at a common understanding of the new system, and creates a baseline for evaluating any later changes to those requirements

Service-Level Agreement

A document that must be prepared and agreed to when a third party is involved in developing an IT solution. It outlines vendor responsibility with respect to system availability, reliability, performance, capacity for growth, level of user support, disaster recovery, security, minimal support functionality, and service charges

Post-Implication Review

An examination of a working information system, conducted soon after that system’s implementation to determine whether the user’s requirements have been satisfied and whether the development effort was efficient and conducted in accordance with the organization’s systems development standards

Biometric Identification Systems

Identify authorized personnel through unique physical traits such as fingers, hands, voice, eyes, face, writing dynamics, and the like

Business Continuity Planning / Disaster Recovery Planning / Contingency Planning / Business Interruption Planning

A process that identifies events that may threaten an organization and provides a framework to ensure that the organization will continue to operate when the threatened event occurs or will resume operations with a minimum amount of disruption

Backup

A copy made to have data, programs, and documentation ready to continue operations in case of failure

Recovery

The process whereby we restore the lost data and resume operations

Mirror Sites

Sites that maintain copies of the primary site’s programs and data

Continuous Data Protection (CDP)

A data replication strategy whereby all data changes are data stamped and saved to secondary systems as the changes are happening

Electronic Vaulting

Service whereby data changes are automatically transmitted over the Internet on a continuous basis to an off-site server maintained by a third party

Hot Site

A fully equipped data center, often housed in bunker-like facilities, that can accommodate many businesses and that is made available to client companies for a monthly subscriber fee

Cold Site

Less costly and less responsive data center. Facility usually comprised of air-conditioned space with a raised floor, telephone connections, and computer ports into which a subscriber can move equipment

Access Control Software

In an online environment, it ensures that (1) only authorized users gain access to a system through a process of identification (e.g., a unique account number for each user) and authentication (e.g., a password to verify that users are who they say they are), (2) restricts authorized users to specific data they require and sets the action privileges for that data (e.g., read, copy, write data), and (3) monitors access attempts and violations

Smartcard

A plastic card with a built-in microprocessor containing data identifying the user. Can be used as part of an access control system for an IT network

Intrusion-Detection System (IDS)

Log and monitor who is on or trying to access a network. Accumulate profiles, flag and report exceptional activity

Intrusion-Prevention System (IPS)

Actively block unauthorized traffic using rules specified by the organization

Data Encryption

A process that employs mathematical algorithms and keys to encode data making it unintelligible to the human eye and useless to those who should not have access to it

Public-Key Cryptography

Helps to keep the problem of keeping encryption keys secret by employing a pair of matched keys for each system user, one private and one public

Hacking / Cracking

The act of breaking into a computer system with malicious intent

Hacker

Someone who simply gets a kick out of breaking into a computer system but does NOT hold malicious intentions to destroy or steal

Cracker

Someone who simply gets a kick out of breaking into a computer system with the motive of crime theft or destruction

Antivirus Software

Software that is designed to defeat technical hacking by detecting malware such as ransomware, keystroke loggers, backdoors, worms, adware, spyware, spam, and so on

Shoulder Surfing

Watches users type in passwords or user IDs or listens as they give accounting information over the phone

Scavenging / Dumpster Diving

Searches through rubbish for system information such as passwords

Smoozing

Calls and requests a password based on some pretext

Password Cracking

Uses software to decode passwords; programs match an encrypted version of a password to a list generated using common encryption algorithms

Phishing

Sends out an email pretending to be a legitimate business asking for information about the user’s account

Spyware

Gets a user to load software that captures user names, passwords, and other information

Denial-of-Service Attack

A Web site is overwhelmed by an intentional onslaught of thousands of simultaneous messages, making it impossible for the attacked site to engage in its normal activities

Distributed Denial-of-Service Attack

Uses many computers that unwittingly cooperate in a denial-of-service by sending messages to the target Web Sites

Preventive Maintenance

Periodic cleaning, testing, and adjusting of computer equipment to ensure equipment’s continued efficient and correct operation

Help Desk

Assistance to overcome problems encountered in using those resources

COBIT 5

The fifth major release of Control Objectives for Information and Related Technology (COBIT), and IT control document; this changes the overall IT control objective from “managing information technology” to the “overall governance of IT”

Governance of Enterprise IT (GEIT)

The overall objective of COBIT 5; specifically, the control of an enterprise’s IT so that operations, information processing, and compliance are optimally achieved

Enablers

The internal control means used to achieve COBIT 5’s governance objectives for an enterprise, especially an all-inclusive governance and management structure for IT